VanuatuData Protection and Privacy Act 2024, special categories and children's personal data
Data Protection and Privacy Act No. 13 of 2024, ss. 6-7
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process special categories of personal data, including biometric data such as a voiceprint or facial image, genetic data, or data revealing racial or ethnic origin, political opinions, trade-union membership, religious belief, health or sexual life, unless an exception in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.NIST Privacy FrameworkCT.PO-P1
- Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put appropriate age-verification mechanisms in place, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 6 prohibits processing special categories of personal data unless an exception applies, and section 7 requires parental or guardian consent for a child's data, clear language for a child and appropriate age verification mechanisms. A mechanism for age verification is a control, not a record of its results, and neither section requires a log, a record, a retention period or an audit.
- Kind
- None
- As of
What this law does
Section 6 prohibits the processing of special categories of personal data, which section 1 defines to include biometric data resulting from specific technical processing, genetic data, and personal data relating to racial or ethnic origin, political opinions, trade-union membership, religious or philosophical belief, health and sexual life, unless one of the exceptions in section 6(2) applies, such as the data subject's explicit consent or a safeguarded public-interest ground.
Section 7 requires the consent of a parent, carer or legal guardian before a child's or other vulnerable individual's personal data is processed, communication with the child in clear and plain language, and appropriate mechanisms for age verification, except where the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.
The Act was assented to on and commenced on , section 32 fixing commencement on the day of publication in the Gazette.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .